Skip to main content

Setting up Okta SSO with Coassemble using OAuth / OpenID Connect (OIDC)

This guide will walk you through configuring Okta so your users can log into Coassemble via SSO using OIDC.

Lucas avatar
Written by Lucas
Updated this week

Step 1: Create an OIDC App in Okta

  1. Log in to Okta Admin Console.

  2. Go to Applications → Applications → Create App Integration.

  3. Select:

    • Sign-in method: OIDC – OpenID Connect

    • Application type: Web Application

  4. Click Next.

  5. Configure General Settings:

    • App name: Coassemble

    • Grant type allowed: Authorization Code (required)

    • Enable Refresh Token

    • Redirect URI:

      https://yourdomain.coassemble.com/security/login/check-custom

    • Sign-out redirect URI: (optional) https://yourdomain.coassemble.com

  6. Click Save.

  7. Copy the Client ID and Client Secret — you’ll need these in Coassemble.

Step 2: Assign Users to the App

  1. Go to Applications → [Coassemble App] → Assignments → Assign → Assign to People.

  2. Select the users or test group you want to allow SSO access.

  3. Ensure status = Active.

Step 3: Configure OAuth in Coassemble

In your Coassemble Admin panel:

  • Authorization URL:

    https://<yourOktaDomain>/oauth2/v1/authorize

  • Access Token URL:

    https://<yourOktaDomain>/oauth2/v1/token

  • UserInfo URL:

    https://<yourOktaDomain>/oauth2/v1/userinfo

  • Scopes:

    openid profile email

  • Identifier / Email claim:

    email

Step 4: Test SSO Login

  1. Open a private/incognito browser window.

  2. Go to Coassemble → login via SSO.

  3. Log in as a test user assigned to the app.

  4. You should be redirected successfully into Coassemble.

Troubleshooting

  • System Log: Okta → Reports → System Log → filter by user.

  • Common errors:

    • no_matching_policy → Authorization Server rule missing / misconfigured

    • invalid_redirect_uri → Redirect URI mismatch

    • policy_denied → Authentication policy (MFA or device restrictions) blocking the login
      ​
      ​To Configure Authorization Server Policy
      ​
      Change your Authorization URLs in Coassemble
      ​
      ​Authorization URL:

      https://<yourOktaDomain>/oauth2/default/v1/authorize

    • Access Token URL:

      https://<yourOktaDomain>/oauth2/default/v1/token

    • UserInfo URL:

      https://<yourOktaDomain>/oauth2/default/v1/userinfo


      This step ensures the OIDC token request succeeds.

      1. In Okta Admin: Security → API → Authorization Servers → default → Access Policies

      2. Click Add Policy:

        • Name: Coassemble OIDC Token Access

        • Assign to: test user(s) or a test group

      3. Click Add Rule:

        • Name: Allow OAuth

        • Grant type: Authorization Code

        • User: Any user assigned the app

        • Scopes: Any scopes

        • Access: Allow

      4. Move this rule to the top of the list.

      5. Save.

      This prevents the no_matching_policy error when Coassemble requests a token.

Notes / Tips

  • Make sure the Redirect URI in Okta matches exactly what Coassemble provides.

  • For public clients, token requests cannot satisfy hardware MFA automatically.

  • Test with a dedicated test user or group before rolling out to your org.

Did this answer your question?